strace viewer

strace shows every system call a program makes, which is exactly why its output is hard to read: thousands of lines, several threads interleaved, and the interesting part buried between mmap calls. This page reads the whole trace and lays it out.

How to use it

Paste the trace or drop the file. The most useful capture is:

strace -f -tt -T -y -o trace.txt <command>        # or -p <pid> to attach to a running process
strace -f -C -w -T -tt -o trace.txt <command>     # the same, plus strace's own summary at the end

-f follows threads and children, -tt adds wall-clock times, -T the time spent in each call, and -y names the file or socket behind every descriptor (-yy adds socket addresses). The page also reads -ttt, -r, no timestamps at all, the [pid N] prefixes strace writes to the terminal, -e trace=… subsets, and a bare strace -c table. macOS dtruss output (with or without -f and the -d/-e/-o columns) is read too, more simply.

What you get:

What stands out — hints in plain words: futex contention versus idle thread pools, many small writes that want a buffer, ENOENT path probing (library and module search paths), EAGAIN loops, refused or slow connects, the DNS resolution flow (resolv.conf, nscd, the A and AAAA queries and the answers), processes killed by signals, mmap churn, clock calls that missed the vDSO, slow calls.
Timeline — one swimlane per process or thread (Java thread names come from prctl(PR_SET_NAME)), each call a bar as long as it took, coloured by kind, errors outlined, signals and exits marked. Wheel or buttons to zoom, drag to pan, hover or tap for the call.
Summary — the table strace -c prints, computed from the trace (and copyable in that format). If the paste has strace’s own table (-C), the two are compared.
Slowest calls, with waiting calls (futex, epoll, poll, sleeps, accept) hidden by default.
Errors grouped by errno with what each one usually means, the failed lookups grouped by file name with where the name was found in the end, and EAGAIN counts per descriptor.
Files and sockets with opens, bytes read and written, call counts and average sizes.
Network — bind/listen, accept with peers, connect with results, and DNS queries and answers decoded from the buffers strace printed.
Processes — the tree from clone/fork/execve with argv, threads, exit codes and signals.
Calls — the whole trace, filterable by text, thread and errors.

Examples has four real traces I captured for this page in throwaway containers: curl fetching an HTTPS page, a small Go HTTP server answering one request, a Python script, and java -version.

How I checked it

For every trace captured with -C (curl, Python, Go and Java, on strace 6.1 and 6.19), the call and error counts this page computes equal strace’s own -c table for every syscall, and the total time agrees within a few per cent (strace’s -w timer versus the rounded -T values). That includes the details strace -c has: calls that never return (exit_group) are not counted, calls that end in = ? ERESTARTSYS are. The tests record it.

To look at where a process spends CPU rather than time in the kernel, use a profiler and the flame graph viewer. Exit codes and signals are explained in the Linux triage page, and Java threads in the thread dump analyser.

Browser support

Any current browser. A trace of a few hundred thousand lines takes a second or two.

Privacy

The trace is read in this page and never uploaded or stored. The examples are a static file from this site.